Addressing the PHP-FPM Vulnerability (CVE-2019-11043) with NGINX<\/p>\n
A recently reported vulnerability, tracked as CVE-2019-11043<\/a><\/span>, can affect websites that use PHP‑FPM to execute PHP pages. PHP‑FPM usage is particularly common at NGINX‑powered websites because NGINX does not have an in‑process PHP runtime. Instead, NGINX acts as a reverse proxy for application servers and process managers such as PHP‑FPM. <\/p>\n The vulnerability lies in PHP‑FPM itself, not NGINX, so the only guaranteed solution is to upgrade to the patched release (or later) of your PHP version: PHP 7.1.33<\/a>, PHP 7.2.24<\/a>, or PHP 7.3.11<\/a>. <\/p>\n NGINX communicates with PHP‑FPM using the FastCGI protocol. Each FastCGI message contains a set of environment variables. One of these, This vulnerability can be triggered by a common NGINX configuration, whereby NGINX uses a regular expression in the As mentioned above, the only certain way to address this vulnerability is to upgrade to the patched release (or later) of your PHP version: PHP 7.1.33<\/a>, PHP 7.2.24<\/a>, or PHP 7.3.11<\/a>.<\/p>\n If you are not able to upgrade your PHP binary immediately, there are two partial mitigations you can make:<\/p>\n Add a Note that this mitigation only works if NGINX and PHP‑FPM share the same docroot on the same host.<\/p>\n<\/li>\n Add a ModSecurity rule to block requests that contain the suspicious This solution is described in the Wallarm’s original report about the vulnerability<\/a>; it may cause false positives and an attacker might still find other ways to exploit the vulnerability.<\/p>\n<\/li>\n<\/ol>\n Rather than rely on PHP‑FPM, you can use NGINX Unit<\/a> to run your PHP applications. NGINX Unit is a high‑performance, open source application server and process manager that supports numerous languages and frameworks<\/a> in addition to PHP. It can auto‑scale PHP applications in response to load, and concurrently run applications that use different PHP runtimes. We provide binaries, source, and Docker images<\/a> for free.<\/p>\n See the NGINX Unit documentation<\/a> for instructions on configuring and operating NGINX Unit for WordPress, a popular, high‑traffic, PHP‑powered application. The deployment takes advantage of the support for serving static files<\/a> in NGINX Unit 1.11.0<\/span> and later.<\/p>\n The post Addressing the PHP-FPM Vulnerability (CVE-2019-11043) with NGINX<\/a> appeared first on NGINX<\/a>.<\/p>\n Source: Addressing the PHP-FPM Vulnerability (CVE-2019-11043) with NGINX<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Addressing the PHP-FPM Vulnerability (CVE-2019-11043) with NGINX A recently reported vulnerability, tracked as CVE-2019-11043, can affect websites that use PHP‑FPM to execute PHP pages. PHP‑FPM usage is particularly common at NGINX‑powered websites because NGINX does not have an in‑process PHP runtime. Instead, NGINX acts as a reverse proxy for application servers and process managers such as PHP‑FPM. The vulnerability lies in PHP‑FPM itself, not NGINX, so the only guaranteed solution is to upgrade to the patched release (or later) of your PHP version: PHP 7.1.33, PHP 7.2.24, or PHP 7.3.11. What Is the Nature of the Vulnerability? NGINX communicates with PHP‑FPM using the FastCGI protocol. Each FastCGI message contains a set of environment variables. One of these, PATH_INFO, is derived from other request parameters. If its value is unexpectedly empty, this can ultimately cause memory corruption in the PHP‑FPM binary. It is possible [ more… ]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[169],"tags":[652],"class_list":["post-33607","post","type-post","status-publish","format-standard","hentry","category-news","tag-nginx"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/33607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/comments?post=33607"}],"version-history":[{"count":1,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/33607\/revisions"}],"predecessor-version":[{"id":33608,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/33607\/revisions\/33608"}],"wp:attachment":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/media?parent=33607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/categories?post=33607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/tags?post=33607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What Is the Nature of the Vulnerability?<\/h2>\n
PATH_INFO<\/code>, is derived from other request parameters. If its value is unexpectedly empty, this can ultimately cause memory corruption in the PHP‑FPM binary<\/a>. It is possible to exploit this situation and make the PHP‑FPM binary run arbitrary commands on the local server.<\/p>\nfastcgi_split_path_info<\/code><\/a> directive to split the request URI into two parts. One way to trigger the vulnerability is to embed a line break (%0a<\/code>) or carriage return (%0d<\/code>) character into the request URI, which is then not correctly handled by the regular expression. <!– For further analysis of the vulnerability, see Tenable blog<\/a>. –><\/p>\nMitigating Against the Vulnerability<\/h2>\n
\n
try_files<\/code><\/a> directive to the NGINX configuration to verify that the $uri<\/code><\/a> variable resolves to a file (the PHP script) and reject the request with code 404<\/code> (Not<\/code> Found)<\/code><\/span> if not:<\/p>\nlocation ~ [^\/].php(\/|$) {\r\n fastcgi_split_path_info ^(.+?.php)(\/.*)$;\r\n fastcgi_param PATH_INFO $fastcgi_path_info;\r\n try_files $uri =404;\r\n #...\r\n}<\/code><\/pre>\n%0a<\/code> or %0d<\/code> character:<\/p>\nSecRule REQUEST_URI \"@rx %0(a|A|d|D)\" \"id:1,phase:1,t:lowercase,deny\"<\/code><\/pre>\nUsing a Different PHP Process Manager<\/h2>\n